I use the Azure equivalent of the AWS WAF but I have no direct experience with AWS WAF. Azure WAF leverages the OWASP ruleset[0] and many of those rules throw f

I use the Azure equivalent of the AWS WAF but I have no direct experience with AWS WAF. Azure WAF leverages the OWASP ruleset[0] and many of those rules throw false-positives, SQL-related rules being one of the top offenders. As you note, it requires adjustment due to overzealous rules. OWASP has Paranoia Levels[1] which allow you to be more targeted. [0] https://github.com/coreruleset/coreruleset https://github.com/coreruleset/coreruleset [1] https://coreruleset.org/20211028/working-with-paranoia-levels/ https://coreruleset.org/20211028/working-with-paranoia-level...